CVE Catalog
CVE-2026-25446
CriticalCVSS 9.9Summary
In WishList Member X versions up to 3.29.0, there is a vulnerability that allows subscribers to upload arbitrary files.
Risk Assessment
An attacker could exploit this vulnerability to upload malicious software, potentially compromising the system.
Recommendation
It is recommended to update to the latest version of WishList Member to mitigate this vulnerability.
Other vulnerabilities in WishList Member X
See all- CVE-2026-57384Medium
WishList Member X plugin version 3.32.0 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. A subscriber can inject malicious script.
- CVE-2026-24575Medium
There is a broken access control issue in WishList Member X versions up to 3.29.0 that may allow unauthorized access to subscribers.
Original NVD description (English source)
Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS